From: Greg Kroah-Hartman Date: Tue, 21 Apr 2015 21:10:09 +0000 (+0200) Subject: 3.10-stable patches X-Git-Tag: v4.0.1~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=acec3ce2eeaa885505d1f7531b5d0f74650d7a36;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: 8139cp-call-dev_kfree_skby_any-instead-of-kfree_skb.patch 8139too-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch benet-call-dev_kfree_skby_any-instead-of-kfree_skb.patch bnx2-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch gianfar-carefully-free-skbs-in-functions-called-by-netpoll.patch ipv6-don-t-reduce-hop-limit-for-an-interface.patch ixgb-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch r8169-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch tcp-fix-frto-undo-on-cumulative-ack-of-sacked-range.patch tcp-prevent-fetching-dst-twice-in-early-demux-code.patch tcp-tcp_make_synack-should-clear-skb-tstamp.patch tg3-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch --- diff --git a/queue-3.10/8139cp-call-dev_kfree_skby_any-instead-of-kfree_skb.patch b/queue-3.10/8139cp-call-dev_kfree_skby_any-instead-of-kfree_skb.patch new file mode 100644 index 00000000000..d85237dd7b2 --- /dev/null +++ b/queue-3.10/8139cp-call-dev_kfree_skby_any-instead-of-kfree_skb.patch @@ -0,0 +1,28 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:14:58 -0700 +Subject: 8139cp: Call dev_kfree_skby_any instead of kfree_skb. + +From: "Eric W. Biederman" + +Replace kfree_skb with dev_kfree_skb_any in cp_start_xmit +as it can be called in both hard irq and other contexts. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/8139cp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/realtek/8139cp.c ++++ b/drivers/net/ethernet/realtek/8139cp.c +@@ -899,7 +899,7 @@ out_unlock: + + return NETDEV_TX_OK; + out_dma_error: +- kfree_skb(skb); ++ dev_kfree_skb_any(skb); + cp->dev->stats.tx_dropped++; + goto out_unlock; + } diff --git a/queue-3.10/8139too-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch b/queue-3.10/8139too-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch new file mode 100644 index 00000000000..e12e074383c --- /dev/null +++ b/queue-3.10/8139too-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch @@ -0,0 +1,31 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:15:36 -0700 +Subject: 8139too: Call dev_kfree_skby_any instead of dev_kfree_skb. + +From: "Eric W. Biederman" + +Replace dev_kfree_skb with dev_kfree_skb_any in functions that can +be called in hard irq and other contexts. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/8139too.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/realtek/8139too.c ++++ b/drivers/net/ethernet/realtek/8139too.c +@@ -1715,9 +1715,9 @@ static netdev_tx_t rtl8139_start_xmit (s + if (len < ETH_ZLEN) + memset(tp->tx_buf[entry], 0, ETH_ZLEN); + skb_copy_and_csum_dev(skb, tp->tx_buf[entry]); +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + } else { +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + dev->stats.tx_dropped++; + return NETDEV_TX_OK; + } diff --git a/queue-3.10/benet-call-dev_kfree_skby_any-instead-of-kfree_skb.patch b/queue-3.10/benet-call-dev_kfree_skby_any-instead-of-kfree_skb.patch new file mode 100644 index 00000000000..d5a51567cc2 --- /dev/null +++ b/queue-3.10/benet-call-dev_kfree_skby_any-instead-of-kfree_skb.patch @@ -0,0 +1,30 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:19:50 -0700 +Subject: benet: Call dev_kfree_skby_any instead of kfree_skb. + +From: "Eric W. Biederman" + +Replace free_skb with dev_kfree_skb_any in be_tx_compl_process as +which can be called in hard irq by netpoll, softirq context +by normal napi polling, and in normal sleepable context +by the network device close method. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/emulex/benet/be_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -1767,7 +1767,7 @@ static u16 be_tx_compl_process(struct be + queue_tail_inc(txq); + } while (cur_index != last_index); + +- kfree_skb(sent_skb); ++ dev_kfree_skb_any(sent_skb); + return num_wrbs; + } + diff --git a/queue-3.10/bnx2-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch b/queue-3.10/bnx2-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch new file mode 100644 index 00000000000..b3629fe27a9 --- /dev/null +++ b/queue-3.10/bnx2-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:17:41 -0700 +Subject: bnx2: Call dev_kfree_skby_any instead of dev_kfree_skb. + +From: "Eric W. Biederman" + +Replace dev_kfree_skb with dev_kfree_skb_any in functions that can +be called in hard irq and other contexts. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnx2.c ++++ b/drivers/net/ethernet/broadcom/bnx2.c +@@ -2869,7 +2869,7 @@ bnx2_tx_int(struct bnx2 *bp, struct bnx2 + sw_cons = BNX2_NEXT_TX_BD(sw_cons); + + tx_bytes += skb->len; +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + tx_pkt++; + if (tx_pkt == budget) + break; +@@ -6610,7 +6610,7 @@ bnx2_start_xmit(struct sk_buff *skb, str + + mapping = dma_map_single(&bp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE); + if (dma_mapping_error(&bp->pdev->dev, mapping)) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + +@@ -6703,7 +6703,7 @@ dma_error: + PCI_DMA_TODEVICE); + } + +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + diff --git a/queue-3.10/gianfar-carefully-free-skbs-in-functions-called-by-netpoll.patch b/queue-3.10/gianfar-carefully-free-skbs-in-functions-called-by-netpoll.patch new file mode 100644 index 00000000000..420d0bb3ad7 --- /dev/null +++ b/queue-3.10/gianfar-carefully-free-skbs-in-functions-called-by-netpoll.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:20:26 -0700 +Subject: gianfar: Carefully free skbs in functions called by netpoll. + +From: "Eric W. Biederman" + +netpoll can call functions in hard irq context that are ordinarily +called in lesser contexts. For those functions use dev_kfree_skb_any +and dev_consume_skb_any so skbs are freed safely from hard irq +context. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -2102,13 +2102,13 @@ static int gfar_start_xmit(struct sk_buf + skb_new = skb_realloc_headroom(skb, fcb_length); + if (!skb_new) { + dev->stats.tx_errors++; +- kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + + if (skb->sk) + skb_set_owner_w(skb_new, skb->sk); +- consume_skb(skb); ++ dev_consume_skb_any(skb); + skb = skb_new; + } + diff --git a/queue-3.10/ipv6-don-t-reduce-hop-limit-for-an-interface.patch b/queue-3.10/ipv6-don-t-reduce-hop-limit-for-an-interface.patch new file mode 100644 index 00000000000..1222108be62 --- /dev/null +++ b/queue-3.10/ipv6-don-t-reduce-hop-limit-for-an-interface.patch @@ -0,0 +1,48 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "D.S. Ljungmark" +Date: Wed, 25 Mar 2015 09:28:15 +0100 +Subject: ipv6: Don't reduce hop limit for an interface + +From: "D.S. Ljungmark" + +[ Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a ] + +A local route may have a lower hop_limit set than global routes do. + +RFC 3756, Section 4.2.7, "Parameter Spoofing" + +> 1. The attacker includes a Current Hop Limit of one or another small +> number which the attacker knows will cause legitimate packets to +> be dropped before they reach their destination. + +> As an example, one possible approach to mitigate this threat is to +> ignore very small hop limits. The nodes could implement a +> configurable minimum hop limit, and ignore attempts to set it below +> said limit. + +Signed-off-by: D.S. Ljungmark +Acked-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ndisc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1193,7 +1193,14 @@ static void ndisc_router_discovery(struc + if (rt) + rt6_set_expires(rt, jiffies + (HZ * lifetime)); + if (ra_msg->icmph.icmp6_hop_limit) { +- in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; ++ /* Only set hop_limit on the interface if it is higher than ++ * the current hop_limit. ++ */ ++ if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) { ++ in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; ++ } else { ++ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n"); ++ } + if (rt) + dst_metric_set(&rt->dst, RTAX_HOPLIMIT, + ra_msg->icmph.icmp6_hop_limit); diff --git a/queue-3.10/ixgb-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch b/queue-3.10/ixgb-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch new file mode 100644 index 00000000000..4fe04d7c62e --- /dev/null +++ b/queue-3.10/ixgb-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch @@ -0,0 +1,43 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:18:42 -0700 +Subject: ixgb: Call dev_kfree_skby_any instead of dev_kfree_skb. + +From: "Eric W. Biederman" + +Replace dev_kfree_skb with dev_kfree_skb_any in functions that can +be called in hard irq and other contexts. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgb/ixgb_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c ++++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c +@@ -1527,12 +1527,12 @@ ixgb_xmit_frame(struct sk_buff *skb, str + int tso; + + if (test_bit(__IXGB_DOWN, &adapter->flags)) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + + if (skb->len <= 0) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + +@@ -1549,7 +1549,7 @@ ixgb_xmit_frame(struct sk_buff *skb, str + + tso = ixgb_tso(adapter, skb); + if (tso < 0) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + diff --git a/queue-3.10/r8169-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch b/queue-3.10/r8169-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch new file mode 100644 index 00000000000..a5be9f650b4 --- /dev/null +++ b/queue-3.10/r8169-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:16:14 -0700 +Subject: r8169: Call dev_kfree_skby_any instead of dev_kfree_skb. + +From: "Eric W. Biederman" + +Replace dev_kfree_skb with dev_kfree_skb_any in functions that can +be called in hard irq and other contexts. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/r8169.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -5768,7 +5768,7 @@ static void rtl8169_tx_clear_range(struc + tp->TxDescArray + entry); + if (skb) { + tp->dev->stats.tx_dropped++; +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + tx_skb->skb = NULL; + } + } +@@ -5993,7 +5993,7 @@ static netdev_tx_t rtl8169_start_xmit(st + err_dma_1: + rtl8169_unmap_tx_skb(d, tp->tx_skb + entry, txd); + err_dma_0: +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + err_update_stats: + dev->stats.tx_dropped++; + return NETDEV_TX_OK; +@@ -6076,7 +6076,7 @@ static void rtl_tx(struct net_device *de + tp->tx_stats.packets++; + tp->tx_stats.bytes += tx_skb->skb->len; + u64_stats_update_end(&tp->tx_stats.syncp); +- dev_kfree_skb(tx_skb->skb); ++ dev_kfree_skb_any(tx_skb->skb); + tx_skb->skb = NULL; + } + dirty_tx++; diff --git a/queue-3.10/series b/queue-3.10/series index 618c985cb2a..68b7ef0869e 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -1,2 +1,14 @@ conditionally-define-u32_max.patch remove-extra-definitions-of-u32_max.patch +tcp-prevent-fetching-dst-twice-in-early-demux-code.patch +ipv6-don-t-reduce-hop-limit-for-an-interface.patch +tcp-fix-frto-undo-on-cumulative-ack-of-sacked-range.patch +tcp-tcp_make_synack-should-clear-skb-tstamp.patch +8139cp-call-dev_kfree_skby_any-instead-of-kfree_skb.patch +8139too-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +r8169-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +bnx2-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +tg3-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +ixgb-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +benet-call-dev_kfree_skby_any-instead-of-kfree_skb.patch +gianfar-carefully-free-skbs-in-functions-called-by-netpoll.patch diff --git a/queue-3.10/tcp-fix-frto-undo-on-cumulative-ack-of-sacked-range.patch b/queue-3.10/tcp-fix-frto-undo-on-cumulative-ack-of-sacked-range.patch new file mode 100644 index 00000000000..b15260caa14 --- /dev/null +++ b/queue-3.10/tcp-fix-frto-undo-on-cumulative-ack-of-sacked-range.patch @@ -0,0 +1,47 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: Neal Cardwell +Date: Wed, 1 Apr 2015 20:26:46 -0400 +Subject: tcp: fix FRTO undo on cumulative ACK of SACKed range + +From: Neal Cardwell + +[ Upstream commit 666b805150efd62f05810ff0db08f44a2370c937 ] + +On processing cumulative ACKs, the FRTO code was not checking the +SACKed bit, meaning that there could be a spurious FRTO undo on a +cumulative ACK of a previously SACKed skb. + +The FRTO code should only consider a cumulative ACK to indicate that +an original/unretransmitted skb is newly ACKed if the skb was not yet +SACKed. + +The effect of the spurious FRTO undo would typically be to make the +connection think that all previously-sent packets were in flight when +they really weren't, leading to a stall and an RTO. + +Signed-off-by: Neal Cardwell +Signed-off-by: Yuchung Cheng +Fixes: e33099f96d99c ("tcp: implement RFC5682 F-RTO") +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3076,10 +3076,11 @@ static int tcp_clean_rtx_queue(struct so + if (seq_rtt < 0) { + seq_rtt = ca_seq_rtt; + } +- if (!(sacked & TCPCB_SACKED_ACKED)) ++ if (!(sacked & TCPCB_SACKED_ACKED)) { + reord = min(pkts_acked, reord); +- if (!after(scb->end_seq, tp->high_seq)) +- flag |= FLAG_ORIG_SACK_ACKED; ++ if (!after(scb->end_seq, tp->high_seq)) ++ flag |= FLAG_ORIG_SACK_ACKED; ++ } + } + + if (sacked & TCPCB_SACKED_ACKED) diff --git a/queue-3.10/tcp-prevent-fetching-dst-twice-in-early-demux-code.patch b/queue-3.10/tcp-prevent-fetching-dst-twice-in-early-demux-code.patch new file mode 100644 index 00000000000..08aea0ae5cf --- /dev/null +++ b/queue-3.10/tcp-prevent-fetching-dst-twice-in-early-demux-code.patch @@ -0,0 +1,56 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: =?UTF-8?q?Michal=20Kube=C4=8Dek?= +Date: Mon, 23 Mar 2015 15:14:00 +0100 +Subject: tcp: prevent fetching dst twice in early demux code + +From: =?UTF-8?q?Michal=20Kube=C4=8Dek?= + +[ Upstream commit d0c294c53a771ae7e84506dfbd8c18c30f078735 ] + +On s390x, gcc 4.8 compiles this part of tcp_v6_early_demux() + + struct dst_entry *dst = sk->sk_rx_dst; + + if (dst) + dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie); + +to code reading sk->sk_rx_dst twice, once for the test and once for +the argument of ip6_dst_check() (dst_check() is inline). This allows +ip6_dst_check() to be called with null first argument, causing a crash. + +Protect sk->sk_rx_dst access by ACCESS_ONCE() both in IPv4 and IPv6 +TCP early demux code. + +Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.") +Fixes: c7109986db3c ("ipv6: Early TCP socket demux") +Signed-off-by: Michal Kubecek +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_ipv4.c | 2 +- + net/ipv6/tcp_ipv6.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1901,7 +1901,7 @@ void tcp_v4_early_demux(struct sk_buff * + skb->sk = sk; + skb->destructor = sock_edemux; + if (sk->sk_state != TCP_TIME_WAIT) { +- struct dst_entry *dst = sk->sk_rx_dst; ++ struct dst_entry *dst = ACCESS_ONCE(sk->sk_rx_dst); + + if (dst) + dst = dst_check(dst, 0); +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1616,7 +1616,7 @@ static void tcp_v6_early_demux(struct sk + skb->sk = sk; + skb->destructor = sock_edemux; + if (sk->sk_state != TCP_TIME_WAIT) { +- struct dst_entry *dst = sk->sk_rx_dst; ++ struct dst_entry *dst = ACCESS_ONCE(sk->sk_rx_dst); + + if (dst) + dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie); diff --git a/queue-3.10/tcp-tcp_make_synack-should-clear-skb-tstamp.patch b/queue-3.10/tcp-tcp_make_synack-should-clear-skb-tstamp.patch new file mode 100644 index 00000000000..0dff49faffc --- /dev/null +++ b/queue-3.10/tcp-tcp_make_synack-should-clear-skb-tstamp.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: Eric Dumazet +Date: Thu, 9 Apr 2015 13:31:56 -0700 +Subject: tcp: tcp_make_synack() should clear skb->tstamp + +From: Eric Dumazet + +[ Upstream commit b50edd7812852d989f2ef09dcfc729690f54a42d ] + +I noticed tcpdump was giving funky timestamps for locally +generated SYNACK messages on loopback interface. + +11:42:46.938990 IP 127.0.0.1.48245 > 127.0.0.2.23850: S +945476042:945476042(0) win 43690 + +20:28:58.502209 IP 127.0.0.2.23850 > 127.0.0.1.48245: S +3160535375:3160535375(0) ack 945476043 win 43690 + +This is because we need to clear skb->tstamp before +entering lower stack, otherwise net_timestamp_check() +does not set skb->tstamp. + +Fixes: 7faee5c0d514 ("tcp: remove TCP_SKB_CB(skb)->when") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2772,6 +2772,8 @@ struct sk_buff *tcp_make_synack(struct s + } + #endif + ++ /* Do not fool tcpdump (if any), clean our debris */ ++ skb->tstamp.tv64 = 0; + return skb; + } + EXPORT_SYMBOL(tcp_make_synack); diff --git a/queue-3.10/tg3-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch b/queue-3.10/tg3-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch new file mode 100644 index 00000000000..ebd67ce11da --- /dev/null +++ b/queue-3.10/tg3-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch @@ -0,0 +1,80 @@ +From foo@baz Tue Apr 21 23:05:58 CEST 2015 +From: "Eric W. Biederman" +Date: Tue, 11 Mar 2014 14:18:14 -0700 +Subject: tg3: Call dev_kfree_skby_any instead of dev_kfree_skb. + +From: "Eric W. Biederman" + +Replace dev_kfree_skb with dev_kfree_skb_any in functions that can +be called in hard irq and other contexts. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/tg3.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -6437,7 +6437,7 @@ static void tg3_tx(struct tg3_napi *tnap + pkts_compl++; + bytes_compl += skb->len; + +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + + if (unlikely(tx_bug)) { + tg3_tx_recover(tp); +@@ -6769,7 +6769,7 @@ static int tg3_rx(struct tg3_napi *tnapi + if (len > (tp->dev->mtu + ETH_HLEN) && + skb->protocol != htons(ETH_P_8021Q) && + skb->protocol != htons(ETH_P_8021AD)) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + goto drop_it_no_recycle; + } + +@@ -7652,7 +7652,7 @@ static int tigon3_dma_hwbug_workaround(s + PCI_DMA_TODEVICE); + /* Make sure the mapping succeeded */ + if (pci_dma_mapping_error(tp->pdev, new_addr)) { +- dev_kfree_skb(new_skb); ++ dev_kfree_skb_any(new_skb); + ret = -1; + } else { + u32 save_entry = *entry; +@@ -7667,13 +7667,13 @@ static int tigon3_dma_hwbug_workaround(s + new_skb->len, base_flags, + mss, vlan)) { + tg3_tx_skb_unmap(tnapi, save_entry, -1); +- dev_kfree_skb(new_skb); ++ dev_kfree_skb_any(new_skb); + ret = -1; + } + } + } + +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + *pskb = new_skb; + return ret; + } +@@ -7716,7 +7716,7 @@ static int tg3_tso_bug(struct tg3 *tp, s + } while (segs); + + tg3_tso_bug_end: +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + + return NETDEV_TX_OK; + } +@@ -7954,7 +7954,7 @@ dma_error: + tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, --i); + tnapi->tx_buffers[tnapi->tx_prod].skb = NULL; + drop: +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + drop_nofree: + tp->tx_dropped++; + return NETDEV_TX_OK; diff --git a/queue-3.14/series b/queue-3.14/series new file mode 100644 index 00000000000..0b8c1cdf2c7 --- /dev/null +++ b/queue-3.14/series @@ -0,0 +1,16 @@ +tcp-prevent-fetching-dst-twice-in-early-demux-code.patch +net-mlx4_en-call-register_netdevice-in-the-proper-location.patch +ipv6-don-t-reduce-hop-limit-for-an-interface.patch +tcp-fix-frto-undo-on-cumulative-ack-of-sacked-range.patch +ipv6-protect-skb-sk-accesses-from-recursive-dereference-inside-the-stack.patch +tcp-tcp_make_synack-should-clear-skb-tstamp.patch +8139cp-call-dev_kfree_skby_any-instead-of-kfree_skb.patch +8139too-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +r8169-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +bonding-call-dev_kfree_skby_any-instead-of-kfree_skb.patch +bnx2-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +tg3-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +ixgb-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +mlx4-call-dev_kfree_skby_any-instead-of-dev_kfree_skb.patch +benet-call-dev_kfree_skby_any-instead-of-kfree_skb.patch +gianfar-carefully-free-skbs-in-functions-called-by-netpoll.patch diff --git a/queue-3.19/series b/queue-3.19/series new file mode 100644 index 00000000000..90b3f229425 --- /dev/null +++ b/queue-3.19/series @@ -0,0 +1,21 @@ +tcp-prevent-fetching-dst-twice-in-early-demux-code.patch +rocker-handle-non-bridge-master-change.patch +net-mlx4_en-call-register_netdevice-in-the-proper-location.patch +ipv6-don-t-reduce-hop-limit-for-an-interface.patch +tun-return-proper-error-code-from-tun_do_read.patch +net-tcp6-fix-double-call-of-tcp_v6_fill_cb.patch +bonding-bonding-overriding-configuration-logic-restored.patch +openvswitch-return-vport-module-ref-before-destruction.patch +xen-netfront-transmit-fully-gso-sized-packets.patch +tcp-fix-frto-undo-on-cumulative-ack-of-sacked-range.patch +ipv6-protect-skb-sk-accesses-from-recursive-dereference-inside-the-stack.patch +net-mlx4_core-fix-error-message-deprecation-for-connectx-2-cards.patch +tcp-tcp_make_synack-should-clear-skb-tstamp.patch +bnx2x-fix-busy_poll-vs-netpoll.patch +bpf-fix-verifier-memory-corruption.patch +revert-net-reset-secmark-when-scrubbing-packet.patch +skbuff-do-not-scrub-skb-mark-within-the-same-name-space.patch +udptunnels-call-handle_offloads-after-inserting-vlan-tag.patch +usbnet-fix-tx_packets-stat-for-flag_multi_frame-drivers.patch +usbnet-fix-tx_bytes-statistic-running-backward-in-cdc_ncm.patch +tg3-hold-tp-lock-before-calling-tg3_halt-from-tg3_init_one.patch